Guide
Network and Information Systems (NIS) Regulations
The NIS Regulations 2018 (as amended in 2022) require operators of essential services and relevant digital service providers to implement appropriate security measures, report significant incidents within 72 hours, and cooperate with sector-specific competent authorities. The Cyber Security and Resilience Bill (introduced November 2025) will further expand scope to managed service providers, data centres, and critical suppliers.
The Network and Information Systems (NIS) Regulations 2018 are the UK's principal cyber security regulations for critical infrastructure and key digital services. They impose mandatory security duties and incident reporting obligations on two categories of organisation: operators of essential services (OES) in sectors such as energy, transport, health, water, and digital infrastructure; and relevant digital service providers (RDSPs) offering online marketplaces, online search engines, or cloud computing services.
The 2022 amendment brought managed service providers (MSPs) into scope and strengthened competent authority powers. The Cyber Security and Resilience Bill, introduced to Parliament on 12 November 2025, will further expand the regulations to cover data centres, additional digital services, and critical suppliers in supply chains.
If your business provides essential services or in-scope digital services in the UK, non-compliance can result in penalties of up to £17 million. A single cyber incident could also trigger parallel enforcement under UK GDPR if personal data is compromised, with a separate maximum penalty of £17.5 million or 4% of global turnover.
Who must comply
Operators of essential services (OES) are organisations in five sectors whose network and information systems support the delivery of essential services:
- Energy: Electricity generators, distributors, and suppliers; gas distribution and supply; oil pipeline operators (regulated by Ofgem)
- Transport: Air carriers, airport operators, rail operators, port authorities, inland waterway operators (regulated by Department for Transport)
- Health: NHS trusts, foundation trusts, and health bodies providing healthcare (regulated by Department of Health and Social Care)
- Drinking water: Water suppliers and distributors (regulated by Defra / Environment Agency)
- Digital infrastructure: Internet exchange point operators, DNS service providers, top-level domain name registries (regulated by Ofcom)
OES in the energy and digital infrastructure sectors are automatically designated. OES in transport, health, and water must receive a written designation notice from their competent authority.
Relevant digital service providers (RDSPs) include businesses providing:
- Online marketplaces: Platforms enabling businesses and consumers to conclude contracts online (e.g. e-commerce platforms, app stores)
- Online search engines: Services enabling keyword-based searches of websites
- Cloud computing services: On-demand network access to shared computing resources (IaaS, PaaS, SaaS)
Security requirements
Both OES and RDSPs must take appropriate and proportionate technical and organisational measures to manage security risks to the network and information systems on which their services depend. In practice, this means:
- Risk management: Identify and assess cyber risks to the systems supporting your essential or digital service, with regular reviews as threats evolve
- Protective measures: Implement technical controls proportionate to the risks identified, including access control, encryption, vulnerability management, and network segmentation
- Detection: Deploy monitoring and detection capabilities to identify potential security events and anomalous activity
- Business continuity: Maintain tested incident response and disaster recovery plans to minimise service disruption
- Supply chain security: Assess and manage security risks from third-party suppliers and service providers
OES are assessed against the NCSC Cyber Assessment Framework (CAF), which sets out 14 principles across four objectives: managing security risk, protecting against cyber attack, detecting cyber security events, and minimising the impact of incidents. RDSPs must follow ICO guidance and may align to standards such as ISO 27001 or NCSC Cyber Essentials.
- Maximum penalty
- £17 million for the most serious breaches
- Incident notification deadline
- Within 72 hours of becoming aware of a significant incident
- Small business exemption (RDSP only)
- Organisations with fewer than 50 employees AND turnover/balance sheet below EUR 10 million are exempt
- OES sectors
- Energy, transport, health, drinking water, digital infrastructure
- RDSP services in scope
- Online marketplaces, online search engines, cloud computing services
- Security framework (OES)
- NCSC Cyber Assessment Framework (CAF) — 14 principles across 4 objectives
- ICO NIS registration fee
- No separate NIS registration fee — RDSPs must register with ICO
Cyber Security and Resilience Bill (2025) will expand scope
-
1. Determine whether your business is in scope
Assess whether you are an operator of essential services (check against Schedule 2 sectors and designation criteria) or a relevant digital service provider (online marketplace, search engine, or cloud computing with 50+ employees and turnover above EUR 10 million). If part of a larger group, assess against group numbers, not your subsidiary alone.
-
2. Register with your competent authority
RDSPs must register with the ICO. OES are either automatically designated (energy, digital infrastructure) or designated by notice from their sector competent authority. If you believe you should be designated, contact the relevant authority proactively.
-
3. Conduct a baseline security assessment
For OES, self-assess against the NCSC Cyber Assessment Framework (CAF) 14 principles. For RDSPs, assess against ICO NIS guidance and consider alignment to ISO 27001 or Cyber Essentials Plus. Identify gaps between your current security posture and the required standard.
-
4. Implement proportionate security measures
Address gaps identified in your assessment. Prioritise controls covering access management, vulnerability management, network monitoring, data protection, and supply chain security. Document all measures and the rationale for their proportionality.
-
5. Establish incident detection and response procedures
Deploy monitoring tools to detect security events. Create an incident response plan with clear roles, escalation paths, and communication templates. Test the plan through regular exercises (at least annually).
-
6. Set up incident reporting processes
Create a notification procedure to report significant incidents to your competent authority within 72 hours. Prepare template notifications covering the required information — nature of incident, affected systems, estimated impact, and initial containment measures. If personal data is involved, you may also need to notify the ICO separately under UK GDPR.
-
7. Manage supply chain security
Assess the security practices of your critical suppliers and service providers. Include security requirements in contracts and conduct periodic reviews. The forthcoming Cyber Security and Resilience Bill will strengthen supply chain duties.
-
8. Document and maintain evidence of compliance
Keep records of risk assessments, security measures implemented, incident response tests, and any incidents reported. Competent authorities can request evidence during inspections or investigations. Review and update documentation at least annually.